Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 63b49e58 authored by Chris Manton's avatar Chris Manton
Browse files

security: Use-After-Free in btm_sec_[dis]connected 

Bug: 201083442
Tag: #security
Test: gd/cert/run
Ignore-AOSP-First: Security

Change-Id: I69c362d1eb644a3b7fd967cd526a8a58c3b4d975
parent 8711f972

system/stack/btm/btm_sec.cc

+1 −1
Original line number Diff line number Diff line
@@ -3384,7 +3384,6 @@ static void btm_sec_connect_after_reject_timeout(UNUSED_ATTR void* data) { 
void btm_sec_connected(const RawAddress& bda, uint16_t handle,

                       tHCI_STATUS status, uint8_t enc_mode,

                       tHCI_ROLE assigned_role) {

  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bda);

  tBTM_STATUS res;

  bool is_pairing_device = false;

  bool addr_matched;
@@ -3392,6 +3391,7 @@ void btm_sec_connected(const RawAddress& bda, uint16_t handle, 


  btm_acl_resubmit_page();



  tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bda);

  if (!p_dev_rec) {

    LOG_DEBUG(

        "Connected to new device state:%s handle:0x%04x status:%s "